fix(audit): retain authenticated consume identity and exact binding

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a140c4-354a-7823-8f0d-8f717397f786

workplans/APPROVAL-WP-0002-production-readiness-and-consumer-adoption.md

@@ -34,6 +34,15 @@ Current status: blocked after the 2026-10-04 dependency review. T02, T03 and
 T06 are complete. T01, T04 and T05 use `wait` for blocked task status; their
 remaining owner receipts are specified in `docs/production-dependencies.md`.
 
+2026-10-16 target-architecture demand reconciliation: CUST-WP-0080 explicitly
+selects necessary authenticated-consume/provenance/audit and exact served-PEP
+interfaces from T01/T04/T05. APPROVAL-WP-0004 implements only the reachable
+source use-evidence gap: verified consuming identity and approved act/PDP binding
+in the existing transactional outbox. This scoped implementation demand does
+not activate unrelated residuals or authorize credentials, migration, rollout,
+production approvals or native effects. T01/T04/T05 remain wait for their
+existing independently owned native receipts; this workplan remains residual.
+
 Review completed 2026-09-01. The plan is active. Production mode will verify
 KeyCape JWT signatures and exact issuer/audience/scopes; local caller-supplied
 identity never becomes authenticated evidence. SQLite remains the first

workplans/APPROVAL-WP-0004-exact-consume-source-provenance.md

@@ -0,0 +1,57 @@
+---
+id: APPROVAL-WP-0004
+type: workplan
+title: "Retain exact authenticated consume source provenance"
+domain: infotech
+repo: approval-engine
+status: active
+flavor: implementation
+owner: codex
+topic_slug: netkingdom
+created: "2026-10-16"
+updated: "2026-10-16"
+depends_on: []
+---
+
+Explicit NetKingdom target demand under CUST-WP-0080 selects the source evidence
+subset of APPROVAL-WP-0002-T01/T04/T05. INTENT basis: authenticated consumable
+object, exact binding and atomic local evidence. Existing authoritative CAS,
+confirmation transport and audit adapter are reused. No second approval/PDP
+service, portable signer, foreign owner review or live action is added.
+
+## Preserve verified consumer and approved operation in the use source row
+
+```task
+id: APPROVAL-WP-0004-T01
+status: done
+priority: high
+```
+
+Source implementation supplies the HTTP-verified Identity to consume and writes
+its bounded metadata plus native act/PDP bindings into the existing atomic use
+outbox. Body-provided provenance is ignored, internal calls retain null, original
+idempotent evidence is immutable, and historical rows remain untouched. No DB
+schema change, response/claim widening or identity scope change is needed.
+Seven new source tests cover signature-verified HTTP consumption, restart,
+adapter preservation, spoofed fields, denied identities, retry immutability and
+rollback. Source checks do not establish native acceptance.
+
+## Integrate independently reviewed source and synchronize work records
+
+```task
+id: APPROVAL-WP-0004-T02
+status: todo
+priority: high
+```
+
+The Custodian coordinator independently reviews the exact patch/manifest, then
+integrates and synchronizes the canonical owner record. Temporary-checkout work
+is not a canonical synchronized record or formal delegated-owner assent.
+
+Existing native delivery obligations remain live under APPROVAL-WP-0002:
+T01 exact issuer/profile and release/migration, T04 admitted lifecycle source
+delivery/reconciliation, T05 named served PEP consumption before protected effect.
+Platform owns mediator transport/identity/custody, the one-shot journal and native
+effect; Secrets owns its actual strict handoff and task-scoped backend. Access
+owns the signed decision and exact request/action/representation binding. No
+claim that an isolated source test closes any of these gates is made.